GIAC Defending Advanced Threats
Domain 1Objective 3
Application Exploitation GDAT Practice Questions (Page 4)
Part of the Initial Access and Execution domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)
44questions here
9free pages
4concepts
Questions 16–20
- 16
Which of the following is a primary defense against exploiting known vulnerabilities in third-party software?
Select an answer first - 17
A security analyst is reviewing a web application that allows users to upload profile pictures. The analyst discovers that the application only checks the Content-Type header provided by the client and does not inspect the actual file contents. An attacker uploads a file with Content-Type: image/png but the file contains PHP code. The attacker then accesses the file directly and executes code on the server. Which vulnerability class is being exploited?
Select an answer first - 18
Which exploitation technique involves redirecting the execution flow of a program to a sequence of existing code snippets, often to bypass non-executable memory protections?
Select an answer first - 19
Which vulnerability class occurs when an application does not properly bound the amount of data written to a fixed-size memory region, potentially allowing an attacker to overwrite adjacent memory?
Select an answer first - 20
A company has a web application that is frequently targeted with SQL injection and cross-site scripting (XSS) attacks. The development team is planning to implement a comprehensive defense. Which of the following is the most effective combination of controls?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.